The Importance of Updating Your iPhone
Apple has become synonymous with security and privacy over the years. So much so, that Mac users rarely even think about downloading antivirus software or worrying their MacBooks or iPhones and iPads are at risk of being infected with malicious software or hacked. In early 2018 though, an unusually easy way to bypass Apple’s signature was discovered and Apple has since scrambled to urge its users to only download apps from trusted sources, such as the App Store.
Apple released OS X Leopard in 2007, and since then, potential hackers have had an easy way to sneak malware past signature checks designed to detect software with fishy signatures. Hackers could do so by duping security tools in third-party apps into thinking the malicious code was actually signed by Apple, and thus grant access to the user’s data and other potentially damaging permissions.
The relative ease of bypassing this digital signature made it possible to hide malware within apps that appear to be safe and signed off by Apple. Digital signatures are an important part of security functions as they let a user know that the app in question uses the private key of a trusted party, such as Apple and its native apps.
Of course, targeting digital key security functions is not only a problem with Apple products, and a determined hacker will eventually overcome any digital signature precautions taken by software companies. However, the fact that it was almost trivially easy to do so, and on products most consumers consider a “walled garden” of safety and security for the past 11 years, brought privacy and security questions to the forefront again.
It is perhaps important to consider why Apple is often thought of as the most private and secure. Most major hacks and malware seem to target Windows operating systems. At first glance, it might seem that Microsoft have been sloppy when it comes to the security of their operating system. However, when one considers the options from a hacker’s perspective, it becomes obvious why Apple products are an afterthought for most hackers and why Microsoft-powered devices are the preferred target. Most of the computers around the world run on Windows, from people’s home computers, to ATMs, to software that help run hospitals, infrastructure and the military. For a hacker, being able to infect as many machines as possible is the goal and given an overwhelming majority of computers run on Windows, it’s only natural to develop malware that targets that OS.
In other words, when less than 10% of the world’s computers run on Mac OS, and almost 90% run on Windows (with a fraction running Linux), it’s only natural that most malware and hacking attempts will target Windows. Therefore, a large part of why most users feel Mac is safer, is because most hackers don’t even bother to mount attacks that could ostensibly only work on 1 out 10 computers in the world.
Market share isn’t the only reason Apple feels safer than Windows though. The app ecosystem in Apple is referred to by many developers as a “walled garden” where only the best and most polished apps make it, usually bug-free. Compared to more open-source friendly ecosystems like Android, where almost anyone can develop their own app and share it with the world with minimal obstacles. This makes it more probable that untrusted apps can make their way onto Android devices, which more readily allow their users to download and run apps from untrusted sources by just a tap of a few buttons, instead of having to “jailbreak” your iPhone or iPad like with Apple. This might provide much more diversity in the Android ecosystem, but that comes at the price of security and privacy, which the Apple ecosystem certainly excels in.
A takeaway from this 11-year vulnerability is that users can never blindly trust any manufacturer or software developer with their device’s security. No matter how secure or private you feel your computer is, hackers will always find a way to deliver malware and exploit weaknesses that haven’t been patched yet. A good rule of thumb to always stick to, is make sure you trust the app’s developer. Funny looking apps with outlandish promises might be packaging malware that can expose your personal and financial data to exploitation by hackers. Stick to apps and software you know have been properly vetted and are widely used across the world. Always keep your OS up to date and if you have anti-virus software, make sure you set it to auto-update. After all, many of the vulnerabilities hackers often exploit have already been patched, but users often postpone updating. So, next time you get a prompt to update your Mac OS X, don’t hit “remind me tomorrow” …
